Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986996)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(268356);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/15");

  script_cve_id("CVE-2021-47303");

  script_name(english:"Unity Linux 20.1070e Security Update: kernel (UTSA-2025-986996)");

  script_set_attribute(attribute:"synopsis", value:
"The Unity Linux host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the
UTSA-2025-986996 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    bpf: Track subprog poke descriptors correctly and fix use-after-free

    Subprograms are calling map_poke_track(), but on program release there is no
    hook to call map_poke_untrack(). However, on program release, the aux memory
    (and poke descriptor table) is freed even though we still have a reference to
    it in the element list of the map aux data. When we run map_poke_run(), we then
    end up accessing free'd memory, triggering KASAN in prog_array_map_poke_run():

      [...]
      [  402.824689] BUG: KASAN: use-after-free in prog_array_map_poke_run+0xc2/0x34e
      [  402.824698] Read of size 4 at addr ffff8881905a7940 by task hubble-fgs/4337
      [  402.824705] CPU: 1 PID: 4337 Comm: hubble-fgs Tainted: G          I       5.12.0+ #399
      [  402.824715] Call Trace:
      [  402.824719]  dump_stack+0x93/0xc2
      [  402.824727]  print_address_description.constprop.0+0x1a/0x140
      [  402.824736]  ? prog_array_map_poke_run+0xc2/0x34e
      [  402.824740]  ? prog_array_map_poke_run+0xc2/0x34e
      [  402.824744]  kasan_report.cold+0x7c/0xd8
      [  402.824752]  ? prog_array_map_poke_run+0xc2/0x34e
      [  402.824757]  prog_array_map_poke_run+0xc2/0x34e
      [  402.824765]  bpf_fd_array_map_update_elem+0x124/0x1a0
      [...]

    The elements concerned are walked as follows:

        for (i = 0; i < elem->aux->size_poke_tab; i++) {
               poke = &elem->aux->poke_tab[i];
        [...]

    The access to size_poke_tab is a 4 byte read, verified by checking offsets
    in the KASAN dump:

      [  402.825004] The buggy address belongs to the object at ffff8881905a7800
                     which belongs to the cache kmalloc-1k of size 1024
      [  402.825008] The buggy address is located 320 bytes inside of
                     1024-byte region [ffff8881905a7800, ffff8881905a7c00)

    The pahole output of bpf_prog_aux:

      struct bpf_prog_aux {
        [...]
        /* --- cacheline 5 boundary (320 bytes) --- */
        u32                        size_poke_tab;        /*   320     4 */
        [...]

    In general, subprograms do not necessarily manage their own data structures.
    For example, BTF func_info and linfo are just pointers to the main program
    structure. This allows reference counting and cleanup to be done on the latter
    which simplifies their management a bit. The aux->poke_tab struct, however,
    did not follow this logic. The initial proposed fix for this use-after-free
    bug further embedded poke data tracking into the subprogram with proper
    reference counting. However, Daniel and Alexei questioned why we were treating
    these objects special; I agree, its unnecessary. The fix here removes the per
    subprogram poke table allocation and map tracking and instead simply points
    the aux->poke_tab pointer at the main programs poke table. This way, map
    tracking is simplified to the main program and we do not need to manage them
    per subprogram.

    This also means, bpf_prog_free_deferred(), which unwinds the program reference
    counting and kfrees objects, needs to ensure that we don't try to double free
    the poke_tab when free'ing the subprog structures. This is easily solved by
    NULL'ing the poke_tab pointer. The second detail is to ensure that per
    subprogram JIT logic only does fixups on poke_tab[] entries it owns. To do
    this, we add a pointer in the poke structure to point at the subprogram value
    so JITs can easily check while walking the poke_tab structure if the current
    entry belongs to the current program. The aux pointer is stable and therefore
    suitable for such comparison. On the jit_subprogs() error path, we omit
    cleaning up the poke->aux field because these are only ever referenced from
    the JIT side, but on error we will never make it to the JIT, so its fine to
    leave them dangling. Removing these pointers would complicate the error path
    for no reason. However, we do need to untrack all poke descriptors from the
    main program as otherwise they could race with the freeing of JIT memory from
    the subprograms. Lastly, a748c6975dea3 (bpf: propagate poke des
    ---truncated---

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://src.uniontech.com/#/security_advisory_detail?utsa_id=UTSA-2025-986996
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a1624ed1");
  # https://lore.kernel.org/linux-cve-announce/2024052126-CVE-2021-47303-72dc@gregkh
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b9207ba6");
  script_set_attribute(attribute:"see_also", value:"https://nvd.nist.gov/vuln/detail/CVE-2021-47303");
  script_set_attribute(attribute:"solution", value:
"Update the affected kernel package.");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2021-47303");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2022/01/28");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/23");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Unity Linux Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/UOS-Server/release", "Host/UOS-Server/rpm-list", "Host/cpu");

  exit(0);
}
include('rpm2.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_product = get_kb_item('installed_os/local/SSH/0/product');
if (isnull(os_product) || 'UOS Server' >!< os_product) audit(AUDIT_OS_NOT, 'UOS Server');
var os_version = get_kb_item('installed_os/local/SSH/0/version');
if (isnull(os_version)) audit(AUDIT_UNKNOWN_APP_VER, 'UOS Server');
if (! preg(pattern:"^20.1070e([^0-9]|$)", string:os_version)) audit(AUDIT_OS_NOT, 'UOS Server 20.1070e', 'UOS Server ' + os_version);

if (!get_kb_item('Host/UOS-Server/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('aarch64' >!< cpu && 'amd64' >!< cpu && 'x86_64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'UOS Server', cpu);


var constraints = [
  {
    'release': '20',
    'sp': '1070e',
    'pkgs': [
      {'reference':'kernel-5.10.0-74.16', 'sp':'1070e', 'cpu':'aarch64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.16', 'sp':'1070e', 'cpu':'amd64', 'rpm_spec_vers_cmp':TRUE},
      {'reference':'kernel-5.10.0-74.16', 'sp':'1070e', 'cpu':'x86_64', 'rpm_spec_vers_cmp':TRUE}
    ]
  }
];

var os_release = get_one_kb_item('installed_os/local/SSH/0/release');
var os_sp = get_one_kb_item('Host/*/minor_release');

var flag = 0;
var reference;
var sp;
var _cpu;
var el_string;
var rpm_spec_vers_cmp;
var epoch;
var allowmaj;
var exists_check;
var cves;
foreach var constraint ( constraints ) {
  # Check that the target release is equal to the affected release
  if (!empty_or_null(constraint['release'])){
    if (constraint['release'] != os_release) continue;
  }
  if (!empty_or_null(constraint['sp'])){
    if (constraint['sp'] != os_sp) continue;
  }
  foreach var pkg ( constraint['pkgs'] ) {
    reference = NULL;
    sp = NULL;
    _cpu = NULL;
    el_string = NULL;
    rpm_spec_vers_cmp = NULL;
    epoch = NULL;
    allowmaj = NULL;
    exists_check = NULL;
    cves = NULL;
    if (!empty_or_null(pkg['reference'])) reference = pkg['reference'];
    if (!empty_or_null(pkg['sp'])) sp = pkg['sp'];
    if (!empty_or_null(pkg['cpu'])) _cpu = pkg['cpu'];
    if (!empty_or_null(pkg['el_string'])) el_string = pkg['el_string'];
    if (!empty_or_null(pkg['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = pkg['rpm_spec_vers_cmp'];
    if (!empty_or_null(pkg['epoch'])) epoch = pkg['epoch'];
    if (!empty_or_null(pkg['allowmaj'])) allowmaj = pkg['allowmaj'];
    if (!empty_or_null(pkg['exists_check'])) exists_check = pkg['exists_check'];
    if (!empty_or_null(pkg['cves'])) cves = pkg['cves'];
    if (reference &&
        ## (no known rpm to check OR known rpm_exists)
        (!exists_check || rpm_exists(rpm:exists_check)) &&
        rpm_check(sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj, cves:cves)) flag++;
  }
}


if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'kernel');
}